kernel/linux.git/drivers/hsi, branch v6.1.168

HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition

2025-04-25T08:43:47+00:00

commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream. In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work. If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi->cl; | // use ssi Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove(). Signed-off-by: Kaixin Wang Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman

HSI: omap_ssi_core: Fix error handling in ssi_init()

2022-12-31T12:32:45+00:00

[ Upstream commit 3ffa9f713c39a213a08d9ff13ab983a8aa5d8b5d ] The ssi_init() returns the platform_driver_register() directly without checking its return value, if platform_driver_register() failed, the ssi_pdriver is not unregistered. Fix by unregister ssi_pdriver when the last platform_driver_register() failed. Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module") Signed-off-by: Yuan Can Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin

HSI: omap_ssi_core: fix possible memory leak in ssi_probe()

2022-12-31T12:32:44+00:00

[ Upstream commit 1aff514e1d2bd47854dbbdf867970b9d463d4c57 ] If ssi_add_controller() returns error, it should call hsi_put_controller() to give up the reference that was set in hsi_alloc_controller(), so that it can call hsi_controller_release() to free controller and ports that allocated in hsi_alloc_controller(). Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver") Signed-off-by: Yang Yingliang Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin

HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()

2022-12-31T12:32:44+00:00

[ Upstream commit f5181c35ed7ba0ceb6e42872aad1334d994b0175 ] In error label 'out1' path in ssi_probe(), the pm_runtime_enable() has not been called yet, so pm_runtime_disable() is not needed. Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver") Signed-off-by: Yang Yingliang Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin

HSI: nokia-modem: Replace of_gpio_count() by gpiod_count()

2022-09-20T15:29:29+00:00

As a preparation to unexport of_gpio_named_count(), convert the driver to use gpiod_count() instead. Signed-off-by: Andy Shevchenko Signed-off-by: Sebastian Reichel

HSI: ssi_protocol: fix potential resource leak in ssip_pn_open()

2022-09-20T15:25:51+00:00

ssip_pn_open() claims the HSI client's port with hsi_claim_port(). When hsi_register_port_event() gets some error and returns a negetive value, the HSI client's port should be released with hsi_release_port(). Fix it by calling hsi_release_port() when hsi_register_port_event() fails. Signed-off-by: Jianglei Nie Signed-off-by: Sebastian Reichel

HSI: omap_ssi_port: Fix dma_map_sg error check

2022-08-29T16:08:48+00:00

dma_map_sg return 0 on error, in case of error return -EIO to caller. Cc: Sebastian Reichel Cc: linux-kernel@vger.kernel.org (open list) Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver") Signed-off-by: Jack Wang Signed-off-by: Sebastian Reichel

HSI: cmt_speech: Pass a pointer to virt_to_page()

2022-08-29T16:08:48+00:00

A pointer into virtual memory is represented by a (void *) not an u32, so the compiler warns: drivers/hsi/clients/cmt_speech.c:1092:35: warning: passing argument 1 of 'virt_to_pfn' makes pointer from integer without a cast [-Wint-conversion] Fix this with an explicit cast. Cc: Kai Vehmanen Cc: Aaro Koskinen Cc: Pavel Machek Signed-off-by: Linus Walleij Signed-off-by: Sebastian Reichel

HSI: omap_ssi: Fix refcount leak in ssi_probe

2022-08-29T16:08:48+00:00

When returning or breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node to possibly release the node. Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver") Signed-off-by: Miaoqian Lin Signed-off-by: Sebastian Reichel

HSI: clients: remove duplicate assignment

2022-08-29T16:08:48+00:00

netdev_alloc_skb() has assigned ssi->netdev to skb->dev if successed, no need to repeat assignment. Signed-off-by: Wang Qing Signed-off-by: Sebastian Reichel